diff --git a/config/user-rbac/basic-user-role.yml b/config/user-rbac/basic-user-role.yml
index 16a94133..edccb1f6 100644
--- a/config/user-rbac/basic-user-role.yml
+++ b/config/user-rbac/basic-user-role.yml
@@ -28,6 +28,9 @@ rules:
 - apiGroups: ["user.appuio.io"]
   resources: ["invitations"]
   verbs: ["get", "watch", "list"]
+- apiGroups: ["rbac.appuio.io", "user.appuio.io"]
+  resources: ["invitations"]
+  verbs: ["create"]
 # Allow redeeming invitations
 - apiGroups: ["user.appuio.io"]
   resources: ["invitationredeemrequests"]